It's not FINished
Mitchell Clarke and Tom Hall

Mitchell Clarke§ Principal Consultant§ London, UK§ 2.5 years at Mandiantsnozberries_au2©2020 FireEye

Tom Hall§ Principal Consultant§ London, UK§ Five years at Mandiant– thall_sec

3©2020 FireEye

Ransomware Operation Trends
Self
Propagating

ManualDetonation

Spray andPray

Targeted
DeploymentPartnership
Models4©2020 FireEye

Self
ManagedAPT§ An attacker has domain admin access to myenvironment§ There are multiple persistence mechanisms§ They likely stole business sensitive data5©2020 FireEye

APT Ransomware§ An attacker has domain admin access to myenvironment§ There are multiple persistence mechanisms§ They likely stole business sensitive data
§ All of my IT infrastructure is down
§ I can’t function as a business6©2020 FireEye

REvil/Sodinokibi

REvil Ransomware as a Service§ First seen May 2019§ Operated by UNKN
§ Affiliate model:– Multiple threat actors use the REvil RaaS
– Affiliates are vetted and buy in– Affiliates receive 60% - 75% of payouts depending onperformance

8©2020 FireEye

REvil Ransomware as a Service§ Each affiliate gains access to the RaaS platform:– Malware generation– Ransom demands and payment service– Victim communications– Coin laundering9©2020 FireEye

Sodinokibi Ransomware§ On the most part, ransomed systems remainfunctional– System-related file extensions and directories areuntouched§ To date, no issues found in crypto§ Each infected system has a unique private key:
– Encrypted and stored in registry– Decrypted with attacker key

10©2020 FireEye

Time to Ransomware Deployment§ It depends on the affiliate§ For comprehensive domain-wide ransomware
deployment:– Up to three to four months– Some affiliates appear to have a backlog of victims

11©2020 FireEye

REvil/Sodinokibi

Initial Compromise§ Mass exploitation of high-profile vulnerabilities forinternet-facing infrastructure:– VPN– SharePoint

Initial Compromise

Establish Foothold

Escalate Privileges

Reconnaissance

Lateral Movement– RDP– Remote Access Applications§ Lateral movement via third parties§ Credential stuffing of internet infrastructure§ Phishing13©2020 FireEye

Maintain Presence

Data TheftRansomware
DeploymentEstablish Foothold
Depends on the affiliate:§ Cobalt Strike§ VPN abuse§ Web shells<%@ Page Language="C#" Debug="true" Trace="false" %><%@ Import Namespace="System.Diagnostics" %><%@ Import Namespace="System.IO" %><html><script Language="c#" runat="server">private const string AUTHKEY = "VictimOrg";
private const string HEADER = "<html>\n<head>\n<title>command</title>\n<style
type=\"text/css\"><!--\nbody,table,p,pre,form input,form select {\n font-family:\"Lucida Console\", monospace;\n font-size: 88%;\n}\n->\n</style></head>\n<body>\n";private const string FOOTER = "</body>\n</html>\n";protected void Page_Load(object sender, EventArgs e)
14©2020 FireEye

Initial Compromise

Establish Foothold

Escalate Privileges

Reconnaissance

Lateral Movement

Maintain Presence

Data TheftRansomware
Deployment

Escalate Privileges§ Mimikatz§ ProcDump§ Passwords within Group Policy Preferences§ Credentials stored in domain shares§ Credentials stored in user profiles:– Documents, text files, etc.

Initial Compromise

Establish Foothold

Escalate Privileges

Reconnaissance

Lateral Movement

Maintain Presence

Data Theft

Ransomware
Deployment

15©2020 FireEye

Reconnaissance§ Similar tools to what we see in APT/FIN intrusions aswell as Red Team engagements:– Advanced IP Scanner– SoftPerfect Network Scanner

Initial Compromise

Establish Foothold

Escalate Privileges

Reconnaissance

Lateral Movement– Bloodhound– Built-in Windows commands

Maintain Presence

Data Theft

Ransomware
Deployment

16©2020 FireEye

Lateral Movement§ WMIExec§ SMBExec§ CrackMapExec§ PsExec§ RDP

Initial Compromise

Establish Foothold

Escalate Privileges

Reconnaissance

Lateral Movement

Maintain Presence

Data TheftRansomware
Deployment

17©2020 FireEye

Maintain Presence§ Cloud remote desktop software§ Cobalt Strike Beacon§ Web shells§ VPN abuse§ On-premise virtual desktop appliances

Initial Compromise

Establish Foothold

Escalate Privileges

Reconnaissance

Lateral Movement

Maintain Presence

Data Theft

Ransomware
Deployment

18©2020 FireEye

Data Theft§ Data compression tools§ Cloud data synchronisation platforms

Initial Compromise

Establish Foothold

Escalate Privileges

Reconnaissance

Lateral Movement

Maintain Presence

Data Theft

Ransomware
Deployment

19©2020 FireEye

Deploy Ransomware§ Disable antivirus across entire estateInitial Compromise

Establish Foothold

Escalate Privileges

Reconnaissance

Lateral Movement

Maintain Presence

Data TheftRansomware
Deployment20©2020 FireEye

Deploy Ransomware§ Disable antivirus across targeted systems@echo off
REM By Robbie Ferguson // baldnerd.com
REM Removes ESET Management Agent (previously named ESET Remote Administrator
Agent) from Windows machines
REM Intended for use as GPO, but could have other applications
REM PLEASE BE MINDFUL - This will remove your connection to your ESMC/ERA server.
Depending on your policies, this could be a very bad thing.
REM This program must be run as administrator
REM Version 1.01
REM Tested successfully with:
REM - ESET Management Agent 7.0.553.0 EEE9596D-3139-4B63-B08B-3F17F0E345F0
echo "Uninstalling ESET Management Agent..."echo "Trying version 6 and under..."wmic product where name="ESET Remote Administrator Agent" call uninstall /nointeractive
echo "Trying version 7 and up..."wmic product where name="ESET Management Agent" call uninstall /nointeractive
21©2020 FireEye

Initial Compromise

Establish Foothold

Escalate Privileges

Reconnaissance

Lateral Movement

Maintain Presence

Data TheftRansomwareDeployment

Deploy Ransomware§ Deletion of:– File Backups– Archives– Virtual Machine snapshots

Initial Compromise

Establish Foothold

Escalate Privileges

Reconnaissance

Lateral Movement

Maintain Presence

Data TheftRansomware
Deployment

22©2020 FireEye

Deploy Ransomware§ Creation of open SMB file shares hosting SODINOKIBI
ransomware§ Deployment of Group Policy Objects to create
scheduled tasks to download and execute theSODINOKIBI ransomware§ PsExec for mop-up

Initial Compromise

Establish Foothold

Escalate Privileges

Reconnaissance

Lateral Movement

Maintain Presence

Data TheftRansomware
Deployment23©2020 FireEye

---=== Welcome. Again. ===---[+] Whats Happen? [+]Your files are encrypted, and currently unavailable. You can check it: all files
on your system has extension <8 unique chars>.
By the way, everything is possible to recover (restore), but you need to follow
our instructions. Otherwise, you cant return your data (NEVER).
[+] What guarantees? [+]Its just a business. We absolutely do not care about you and your deals, except
getting benefits. If we do not do our work and liabilities - nobody will notcooperate with us. Its not in our interests.
To check the ability of returning files, You should go to our website. There you
can decrypt one file for free. That is our guarantee.
If you will not cooperate with our service - for us, its does not matter. But you
will lose your time and data, cause just we have the private key. In practice time is much more valuable than money.
[+] How to get access on website? [+]24©2020 FireEye

Ransomware Negotiation

25©2020 FireEye

The REvil Attack Lifecycle
Overview
Maintain Presence

Remote desktopsoftware, VPN
abuse

Move Laterally

Access toadditional
networks anddomains

Complete the mission

Identify Targets

Initial Compromise

Establish Foothold

Escalate PrivilegesInternal Reconnaissance

Data Theft

Identify Exploitable
Vulnerabilities

Phishing, credential reuse,compromise of external
infrastructure

Cobalt Strike, VPN abuse,
web shells

Mimikatz, credentials indomain shares

Network scanning,
BloodhoundInstallation of cloud-sync
software26©2020 FireEye

Ransom Event

Scheduled task GPO deployment,
PsExecQAKBOT and DOPPELPAYMERPartnership Model§ QAKBOT initially deployed as a banking trojan§ In 2020, the partnership model is seen
– Ransomware developers are provided access toa compromised environment with QAKBOT– Negotiations for payment are handled by theransomware developers themselves

28©2020 FireEye

Ransomware Attack Life Cycle
Partner
Organisation

Maintain Presence

QAKBOT, Cobalt
StrikeIdentify Targets

Identify targetorganisations

29©2020 FireEye

Ransomware
Developer

Move Laterally

PsExec, Remote
Desktop

Initial Compromise

Establish Foothold

Escalate PrivilegesInternal Reconnaissance

Data Theft

Phishing

QAKBOT, Cobalt Strike

Mimikatz, Procdump

Identify domains and networksof interest

QAKBOT email module

Ransom Event

DOPPELPAYMER

Initial Compromise§ QAKBOT campaigns in early 2020 were seenutilising unsophisticated phishing campaigns<a href="https://<redacted>[.]<redacted>/direct/4345091.zip">
ATTACHMENT DOCUMENT</a>30©2020 FireEyeQAKBOT§ QAKBOT is a modular backdoor which allows
an attacker to select the capabilities
required and upload through the default
configuration

Modules
Email Staging

Cobalt StrikeWeb Injects

31©2020 FireEye

Email Staging Module§ The email module is a standalone binary,Modules
Email Staging

independent from other QAKBOT modules§ The module creates a directory for email staging,and utilises MAPI connections to a local outlook
instance– %USERPROFILE%\EmailStorage_<computer_name><username>_<timestamp>§ Collected data is sent to a hard coded C2 with thedata ZLIB compressed and base64 encoded32©2020 FireEye

Cobalt StrikeWeb Injects

Cobalt Strike Module§ QAKBOT can load Cobalt Strike in two ways

Modules
Email Staging– Arbitrary Downloads§ The attackers can push the Cobalt Strike loader as

Cobalt Strikea file and execute locally– Custom module§ The Cobalt Strike module can be configured toload a pre-configured DLL which downloads andexecutes the Cobalt Strike payload

33©2020 FireEye

Web Injects

Web Inject Module§ The module works by injecting the contents of theModules
Email Staging

below file into explorer.exe– <install_path>\webinjects.cb§ The module iterates through a list of pre-configured

Cobalt Strikesites and injects JavaScript elements§ Targeting appears related to Northern Americanorganisations, as exampled below

34©2020 FireEye

Web Injects

DOPPELPAYMER§ In early 2020, the following delivery mechanisms
were seen– Group Policies§ Binaries placed in SYSVOL locations and deployed

across the domain using scripts– PsExec– BITS Jobs
– Scheduled Tasks35©2020 FireEye

Four stage processfrom delivery ofransomware binary toencryption of files

Stage 1§ The DOPPELPAYMER variant enumerates all users for the local
system and changes the password§ The password is generated with a pre-configured string andan MD5 hash of the computer name– Preconfigured string: TtXtE9n3– Computer name hash: 384DFCCEE8DB9F89ED2859E3F32F6AF5– Full password: TtXtE9n3&384DFCCEE8DB9F89ED2859E3F32F6AF536©2020 FireEye

1. Enumerates allusers and changes
password

Stage 2

1. Enumerates allusers and changes
password§ The ransomware copies a legitimate service and replaces
the original with a copy of itself– File: <random>.exe§ Path: %APPDATA%\<random>.exe§ Note: Copy of DOPPELPAYMER binary– Service: <random_service>§ Path: %WINDIR%\system32\<random_service>.exe§ Note: Ransomware Service– Service: <random_service>-1§ Path: %WINDIR%\system32\<random_service>.exe-1§ Note: Backup of Service

37©2020 FireEye

2. Registers theransomware as aservice

Stage 3

1. Enumerates allusers and changes
password§ The Boot Configuration database is altered– recoveryenabled: no§ Startup repair is disabled– safeboot: minimal

2. Registers theransomware as aservice§ Ransomware service is started in safeboot– Group policy configured to display a ransom message prior to login

38©2020 FireEye

3. Changes BootConfiguration
DatabaseStage 4

1. Enumerates allusers and changes
password§ After rebooting, the DOPPELPAYMER variant will begin
encrypting files on the system.
– <filename>.doppeled– <filename>.how2decrypt.txt

2. Registers theransomware as aservice

3. Changes Boot
Configuration
Database

4. Reboots thesystem andencrypts files
39©2020 FireEye

Takeaway§ Highly effective– QAKBOT has been around for a long time

§ High impact– DOPPELPAYMER removes access to systems§ Highly active– As many as an organisation a day in periods of2020

40©2020 FireEye

Conclusion

A Continuing Problem§ Everything is increasing:– Payouts– Number of victims– Damage to organisations– Extortion for stolen data

§ With so much profit, so many victims, the only trend isupwards§ Ransomware is now a boardroom risk42©2020 FireEyeImprovements to Tradecraft§ More stealth, less noise– Ransomware engagements are fast, but they’re loud§ Tooling improvements– Less reliance on standard penetration testing tools– More bespoke malware§ Faster to domain admin§ Improved ransomware deployment methods§ Increased effectiveness to delete backups

43©2020 FireEye

What’s Next?
§ Continued focus on mass exploitation of edgedevices§ Limiting factors for the attackers:– Too many victims– Not enough operators§ No downwards pressure until law enforcement
intervention– The best organisations can do is to:§ improve security§ improve resilience

44©2020 FireEye

Thank you